eligible 2.6.1 → 2.6.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 3a05ae8ed310f92bfdb9169633be20e586d904bf
-  data.tar.gz: 7bc7e0bce25b7e2584414c6c63b08f85740be705
+  metadata.gz: 3c044453aea1d5ef70a34c8e8b2e08bd0bdd9e65
+  data.tar.gz: 3219b7cba1332fb1a8b9cf8254f731242aa05bd4
 SHA512:
-  metadata.gz: 2bac9428455a3ca9b8361f75d30d79b0b61ef590c6778a4f4a7f2f36b7afec21b72c2f89eed0364e94e2a907c019966ab93d8892135cf4941df5ee71f52dfb4f
-  data.tar.gz: c42fe8b8b825e9dd3227d86292fae9f7953e7ddd72e1703faafcda5cd1d876e791c54ad78814cc19facf2e666a2999d4ba6a451a5c37a525da7678256e90b503
+  metadata.gz: eceba947c63c89845382f4bfdc5734bc78eee5ae190bcdc7a6fb51675b2f896da9c7ed9bd2b0e66ce425d4606a6ffbf4d7d7c8a866e768863f3b187c8c690760
+  data.tar.gz: 2555d78ea46984e2b12afca36cd79a76d6887868bbd4fdafae7406afa0e9c9472ac522484e7f4cb38761b804b9195b83b173c14f5f67835e3c1004edbc99cb95

data/.ruby-version

@@ -0,0 +1 @@
+2.2.3

data/ChangeLog

@@ -1,9 +1,13 @@
+2016-08-31  Eligible  <support@eligible.com>
+	* 2.6.2
+	- New APIs added in testing mode, no public-facing changes
+
 2016-05-10  Eligible  <support@eligible.com>
 	* 2.6.1
-        - Suppressing ssl_verify_callback return code warning
-        - Added new endpoints: received_pdf, precert and referral
-        - Refactored the code and fixed couple of bugs
-        - Documentation updates for the endpoints
+	- Suppressing ssl_verify_callback return code warning
+	- Added new endpoints: received_pdf, precert and referral
+	- Refactored the code and fixed couple of bugs
+	- Documentation updates for the endpoints
 
 2016-02-23  Eligible  <support@eligible.com>
 	

data/lib/eligible.rb

@@ -8,6 +8,7 @@ require 'rest_client'
 require 'multi_json'
 
 require 'eligible/version'
+require 'eligible/encryptor'
 require 'eligible/util'
 require 'eligible/json'
 require 'eligible/eligible_object'
@@ -28,6 +29,8 @@ require 'eligible/payer'
 require 'eligible/preauth_resource'
 require 'eligible/precert'
 require 'eligible/referral'
+require 'eligible/public_key'
+require 'eligible/lockbox'
 
 # Errors
 require 'eligible/errors/eligible_error'

data/lib/eligible/encryptor.rb

@@ -0,0 +1,115 @@
+require 'openssl'
+
+module Eligible
+  # A simple wrapper for the standard OpenSSL library
+  module Encryptor
+
+    extend self
+
+    # The default options to use when calling the <tt>encrypt</tt> and <tt>decrypt</tt> methods
+    #
+    # Defaults to { algorithm: 'aes-256-gcm',
+    #               auth_data: '',
+    #               insecure_mode: false,
+    #               hmac_iterations: 2000,
+    #               v2_gcm_iv: false }
+    #
+    # Run 'openssl list-cipher-commands' in your terminal to view a list all cipher algorithms that are supported on your platform
+    def default_options
+      @default_options ||= { algorithm: 'aes-256-cbc',
+                             auth_data: '',
+                             insecure_mode: false,
+                             hmac_iterations: 2000,
+                             v2_gcm_iv: false }
+    end
+
+    # Encrypts a <tt>:value</tt> with a specified <tt>:key</tt> and <tt>:iv</tt>.
+    #
+    # Optionally accepts <tt>:salt</tt>, <tt>:auth_data</tt>, <tt>:algorithm</tt>, <tt>:hmac_iterations</tt>, and <tt>:insecure_mode</tt> options.
+    #
+    # Example
+    #
+    #   encrypted_value = Encryptor.encrypt(value: 'some string to encrypt', key: 'some secret key', iv: 'some unique value', salt: 'another unique value')
+    #   # or
+    #   encrypted_value = Encryptor.encrypt('some string to encrypt', key: 'some secret key', iv: 'some unique value', salt: 'another unique value')
+    def encrypt(*args, &block)
+      crypt :encrypt, *args, &block
+    end
+
+    # Decrypts a <tt>:value</tt> with a specified <tt>:key</tt> and  <tt>:iv</tt>.
+    #
+    # Optionally accepts <tt>:salt</tt>, <tt>:auth_data</tt>, <tt>:algorithm</tt>, <tt>:hmac_iterations</tt>, and <tt>:insecure_mode</tt> options.
+    #
+    # Example
+    #
+    #   decrypted_value = Encryptor.decrypt(value: 'some encrypted string', key: 'some secret key', iv: 'some unique value', salt: 'another unique value')
+    #   # or
+    #   decrypted_value = Encryptor.decrypt('some encrypted string', key: 'some secret key', iv: 'some unique value', salt: 'another unique value')
+    def decrypt(*args, &block)
+      crypt :decrypt, *args, &block
+    end
+
+    protected
+
+      def crypt(cipher_method, *args) #:nodoc:
+        options = default_options.merge(value: args.first).merge(args.last.is_a?(Hash) ? args.last : {})
+        raise ArgumentError.new('must specify a key') if options[:key].to_s.empty?
+        cipher = OpenSSL::Cipher.new(options[:algorithm])
+        cipher.send(cipher_method)
+        unless options[:insecure_mode]
+          raise ArgumentError.new("key must be #{cipher.key_len} bytes or longer") if options[:key].bytesize < cipher.key_len
+          raise ArgumentError.new('must specify an iv') if options[:iv].to_s.empty?
+          raise ArgumentError.new("iv must be #{cipher.iv_len} bytes or longer") if options[:iv].bytesize < cipher.iv_len
+        end
+        if options[:iv]
+          # This is here for backwards compatibility for Encryptor v2.0.0.
+          cipher.iv = options[:iv] if options[:v2_gcm_iv]
+          if options[:salt].nil?
+            # Use a non-salted cipher.
+            # This behaviour is retained for backwards compatibility. This mode
+            # is not secure and new deployments should use the :salt options
+            # wherever possible.
+            cipher.key = options[:key]
+          else
+            # Use an explicit salt (which can be persisted into a database on a
+            # per-column basis, for example). This is the preferred (and more
+            # secure) mode of operation.
+            cipher.key = OpenSSL::PKCS5.pbkdf2_hmac_sha1(options[:key], options[:salt], options[:hmac_iterations], cipher.key_len)
+          end
+          cipher.iv = options[:iv] unless options[:v2_gcm_iv]
+        else
+          # This is deprecated and needs to be changed.
+          cipher.pkcs5_keyivgen(options[:key])
+        end
+        yield cipher, options if block_given?
+        value = options[:value]
+        if cipher.authenticated?
+          if encryption?(cipher_method)
+            cipher.auth_data = options[:auth_data]
+          else
+            value = extract_cipher_text(options[:value])
+            cipher.auth_tag = extract_auth_tag(options[:value])
+            # auth_data must be set after auth_tag has been set when decrypting
+            # See http://ruby-doc.org/stdlib-2.0.0/libdoc/openssl/rdoc/OpenSSL/Cipher.html#method-i-auth_data-3D
+            cipher.auth_data = options[:auth_data]
+          end
+        end
+        result = cipher.update(value)
+        result << cipher.final
+        result << cipher.auth_tag if cipher.authenticated? && encryption?(cipher_method)
+        result
+      end
+
+      def encryption?(cipher_method)
+        cipher_method == :encrypt
+      end
+
+      def extract_cipher_text(value)
+        value[0..-17]
+      end
+
+      def extract_auth_tag(value)
+        value[-16..-1]
+      end
+  end
+end

data/lib/eligible/lockbox.rb

@@ -0,0 +1,39 @@
+require 'openssl'
+require 'base64'
+
+module Eligible
+  class Lockbox < APIResource
+    def self.get(params, api_key = nil)
+      send_request(:get, api_url('lockboxes', params, :lockbox_id), api_key, params, :lockbox_id)
+    end
+
+    def self.all(params, api_key = nil)
+      send_request(:get, api_url('lockboxes'), api_key, params)
+    end
+
+    def self.extract_private_key(params)
+      private_key = Util.value(params, :private_key)
+      fail ArgumentError, "Private key is required for decryption" if private_key.nil?
+      private_key
+    end
+
+    def self.delete_private_key!(params)
+      params.delete('private_key')
+      params.delete(:private_key)
+    end
+
+    def self.decrypt_data(data, encrypted_data_key, private_key)
+      pkey = OpenSSL::PKey::RSA.new(private_key)
+      aes_key = pkey.private_decrypt(Base64.decode64(encrypted_data_key))
+      sha_key = Digest::SHA256.hexdigest(aes_key)
+      Encryptor.decrypt(value: Base64.decode64(data), key: sha_key, insecure_mode: true)
+    end
+
+    def self.get_and_decrypt_from_lockbox(params, api_key = nil)
+      private_key = extract_private_key(params)
+      delete_private_key!(params)
+      req = get(params, api_key).to_hash
+      decrypt_data(req[:encrypted_data], req[:encrypted_key], private_key)
+    end
+  end
+end

data/lib/eligible/public_key.rb

@@ -0,0 +1,27 @@
+require 'openssl'
+
+module Eligible
+  class PublicKey < APIResource
+    def self.get(params, api_key = nil)
+      send_request(:get, api_url('public_keys', params, :key_id), api_key, params, :key_id)
+    end
+
+    def self.post(params, api_key = nil)
+      send_request(:post, api_url('public_keys'), api_key, params)
+    end
+
+    def self.activate(params, api_key = nil)
+      key_id = Util.value(params, :key_id)
+      send_request(:get, "/public_keys/#{key_id}/activate.json", api_key, params, :key_id)
+    end
+
+    def self.all(params, api_key = nil)
+      send_request(:get, api_url('public_keys'), api_key, params)
+    end
+
+    def self.create_pair
+      rsa_key = OpenSSL::PKey::RSA.new(4096)
+      [ rsa_key.to_pem, rsa_key.public_key.to_pem ]
+    end
+  end
+end

data/lib/eligible/version.rb

@@ -1,3 +1,3 @@
 module Eligible
-  VERSION = '2.6.1'.freeze
+  VERSION = '2.6.2'.freeze
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: eligible
 version: !ruby/object:Gem::Version
-  version: 2.6.1
+  version: 2.6.2
 platform: ruby
 authors:
 - Katelyn Gleaon
@@ -10,7 +10,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-05-10 00:00:00.000000000 Z
+date: 2016-08-31 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rest-client
@@ -110,6 +110,7 @@ files:
 - ".gitignore"
 - ".rspec"
 - ".rubocop.yml"
+- ".ruby-version"
 - ChangeLog
 - Gemfile
 - LICENSE
@@ -124,6 +125,7 @@ files:
 - lib/eligible/customer.rb
 - lib/eligible/demographic.rb
 - lib/eligible/eligible_object.rb
+- lib/eligible/encryptor.rb
 - lib/eligible/enrollment.rb
 - lib/eligible/errors/api_connection_error.rb
 - lib/eligible/errors/api_error.rb
@@ -131,12 +133,14 @@ files:
 - lib/eligible/errors/eligible_error.rb
 - lib/eligible/errors/invalid_request_error.rb
 - lib/eligible/json.rb
+- lib/eligible/lockbox.rb
 - lib/eligible/medicare.rb
 - lib/eligible/original_signature_pdf.rb
 - lib/eligible/payer.rb
 - lib/eligible/payment.rb
 - lib/eligible/preauth_resource.rb
 - lib/eligible/precert.rb
+- lib/eligible/public_key.rb
 - lib/eligible/received_pdf.rb
 - lib/eligible/referral.rb
 - lib/eligible/ticket.rb